Simplify Docker based deployments and provide example docker-compose.yml

[alexandreteles]

Ideally the Docker image should contain only the fief-server and fief-worker services. Some considerations:

1. The requirement to use docker exec to setup a Docker installation breaks the ability to run the container from docker-compose without ugly hacks (please see Execute a command after run docker/compose#1809), so allowing first-run configuration to be done via env would be really cool;
2. Adding redis directly into the Docker container makes it difficult to build a stack without redundant services unless you expose fief's redis to other services in the stack, so having a second container running redis might be a better option if you're willing to provide a docker-compose.yml file.

[frankie567]

Hello @alexandreteles, welcome to Fief 👋

The goal with the all-in-one Docker image was to provide an easy way to run a Fief system, in particular during local development. I think it's quite convenient to have a one-liner to run everything, without having to create a configuration file.

Now, for a proper production deployment; yes, a Docker Compose can be useful, with the proper containers setup. We could add an example to the documentation, but it could look like something like this:

# docker-compose.yml
version: "3.9"

services:
  fief-server:
    image: ghcr.io/fief-dev/fief:latest
    command: fief run-server --port $PORT
    ports:
      - "8000:8000"
    env_file:
      - .env

  fief-worker:
    image: ghcr.io/fief-dev/fief:latest
    command: fief run-worker -p 1 -t 1
    env_file:
      - .env

  postgres:
    image: postgres:alpine
    environment:
      - POSTGRES_PASSWORD=fief
      - POSTGRES_USER=fief
      - POSTGRES_DB=fief
    volumes:
      - postgres-data:/var/lib/postgresql/data

  redis:
    image: redis:alpine
    command: redis-server --save 60 1 --loglevel warning
    volumes:
      - redis-data:/data

volumes:
  redis-data:
  postgres-data:

# .env
SECRET=XXX
FIEF_CLIENT_ID=XXX
FIEF_CLIENT_SECRET=XXX
ENCRYPTION_KEY=XXX
PORT=8000
ROOT_DOMAIN=localhost:8000
FIEF_DOMAIN=localhost:8000
CSRF_COOKIE_SECURE=False
LOGIN_SESSION_COOKIE_SECURE=False
SESSION_COOKIE_SECURE=False
FIEF_ADMIN_SESSION_COOKIE_SECURE=False

DATABASE_TYPE=POSTGRESQL
DATABASE_HOST=postgres
DATABASE_PORT=5432
DATABASE_USERNAME=fief
DATABASE_PASSWORD=fief
DATABASE_NAME=fief

REDIS_URL=redis://redis:6379

Notice how we override the command to only run the process we're interested in. In this configuration, the Fief image won't run the internal Redis. This is what I do myself for the cloud deployment.

Docker volumes are also configured so we can persist the data of the PostgreSQL and the Redis even if we delete the containers.

[alexandreteles]

I do have a question: how does that solve the "first setup" problem? Can you create tenants and the first user from the web interface or will you still be required to execute those commands after the container is created?

[frankie567]

Well, indeed the first setup commands are still required.

What we could do is to add new environment variables to define the "first superuser" and improve the startup command so it checks 1. If the workspace exists and 2. If this superuser exists; and create them if needed. What do you think?

[alexandreteles]

I think that would be enough to allow us to deploy it in production without the need for any user input. btw thank you for the quick replies, you guys are incredibly responsive!

[frankie567]

My pleasure! You can follow this improvement in #71!

[frankie567]

Hello @alexandreteles 👋

Following our discussion, those improvements are now live in v0.17.0.

The quickstart have been greatly simplified thanks to the automatic creation of main workspace and admin user: https://docs.fief.dev/self-hosting/quickstart/

I've also added guidelines about production deployment with Docker Compose: https://docs.fief.dev/self-hosting/deployment/docker-compose/

[alexandreteles]

Thank you very much. I'll move with deployment and let you know if anything goes wrong.